Overview
Multi-Factor Authentication (MFA) is the practice of requiring two or more independent "factors" to verify identity. These are traditionally categorized as:
- Knowledge - something that you know, such as a password/passphrase, PIN, or answers to security questions.
- Possession - something that you have, such as a security token, smartphone, or YubiKey.
- Inherence - something that you are, biometrics such as your face, fingerprints, or iris/retina scans.
The security of MFA relies on the independence of these factors, which basically means that the compromise of one factor should not reveal or compromise the others. It also means that access to one of the factors cannot automatically enable access to another factor. You may also note that the categories above all have another kind of separation: a password is something that you typically store in your head, while a security token is something that is either a physical device that you possess and control or a digital token that is sent to you from a trusted and secure source. In high-security environments, the addition of an inherence factor is often a requirement because a finger or an eye cannot be loaned to a colleague or stolen from you (except in some extreme cases).
To those not familiar with security applications, there is often some confusion between (or even recognition of) different applications of biometric security and the resulting ethical implications. There are three basic use cases for biometrics:
- Verification (or 1:1 matching). This is "identity confirmation." The user claims an identity (e.g., swipes a badge) and provides a biometric. The system compares the live sample only against the template stored for that specific user.
- The template is not the raw image, but an encrypted mathematical representation of the image. The template data is primarily stored in one of three locations: on the user's device (Apple FaceID, Android Biometrics, etc.), in a centralized cloud/server database (banking Know Your Customer systems, corporate access control systems, etc.), or on discrete portable tokens (secure access cards, e-passports, etc.).
- On-device storage means the data resides in a highly secure and isolated hardware element (TPM chip), and it never leaves the secure device, which enhances privacy, but limits use for authentication across different devices.
- Database storage means the templates are stored in a secure, remote server and the user's live scan is sent to the server for comparison. Newer systems are leveraging edge computing to allow the comparison to be made at the source of the scan, with the server sending an encrypted version of the template weather then the scanner sending an image. These systems also typically are contained within internal networks where the security of the scanner-server connection can be controlled and monitored. While this method allows for authentication across multiple devices, it also introduces an additional risk of server breach.
- Portable tokens are similar to on-device storage in that the template is stored on a secure chip embedded into a card or document that is carried by the user. Privacy is enhanced because the user retains possession of their data, but the card or document can be lost. Portable tokens can generally be used for authentication to multiple devices.
- Identification (1:N Matching). This is "identity discovery," where a sample is used to search an entire database of N users to find a match in much the same way that one might search a database for a name of other information. The challenge in this case is that the biometric data capture of the sample may not be accurate with respect to the capture of the stored templates. This can lead to both false positives and false negatives.
- Biometric Surveillance (Crowd Scanning). This is generally a "N:N" matching, and involves scanning a collection of unknown individuals (a crowd on a street, for example) and comparing every member of that collection against a database of known individuals. While this is often employed in public places where the expectation of privacy is different than it is in places or areas with restricted access of some kind, it still raises many ethical concerns. This application also faces the most significant technical challenges, as the images of the subjects in the "crowd" are not captured in a consistent manner, meaning that the sample templates generated will be missing a significant amount of data, particularly compared to stored data which is generally collected under more controlled conditions.
You are close to the end of your first year at IDMan, Inc., a mid-sized identity management and data security company that specializes in solutions for the healthcare industry. You are working on a project team that is putting the final touches on a new biometric-based multifactor authentication suite for a local healthcare provider that operates a network of hospitals, clinics, and primary care facilities. This system will be replacing an antiquated password-based system that has been in use since there was only a single hospital. The system will be deployed to all employees, contractors, and doctors with admitting and surgical permissions at the provider's facilities. The system will deliver a tiered access control solution, with different tiers of identity verification depending upon the sensitivity of the resources accessed: - Basic access for general building security will use only a "smart" ID badge. This will only be used for low-security access, such as employee breakrooms, medical equipment storage, and general medical supply (bandages, etc.) areas.
- Access to secured areas and resources, including physical patient care areas, unscheduled (over-the-counter) and schedule 2 medications, and patient medical records will require a 2-factor authentication that includes a verified username/password or smart ID badge and a biometric credential (finger or face scan).
- Access to high-security resources such as the controlled substances pharmacy, radiology suites and machines, and restricted psychiatric care areas will require 3-factor identity verification using a smart badge, fingerprint scan, and iris scan.